Android battery upgrade 'scareware'

A new "scareware" targeting mobile devices running Google's Android operating system is on the loose, warning users their battery is draining and urging them to download a power-saving patch. Once installed, the "patch" - dubbed "Battery Upgrade" or "Battery Doctor" - would secretly phone home and provide information about the phone and its owner, computer security firm Solera Networks said. "In this investigation, taken at the request of PCWorld, I found that the Battery Upgrade variant seems to cross a software distribution method ethical line. Battery Upgrade has been deliberately designed to take the appearance of an operating system patch or update. The untrained eye may miss the subtle clues that the software is not what it appears to be," Solera Networks' Andrew Brandt said in a blog post. Worse, he said just visiting the Web page where the program is hosted triggers a "push" download of the Android app from the server. Upon first execution, an overview window appears and relays some information about the battery and running apps. But in the background, the program begins invisibly phoning home to its parent ad server, lp.mobsqueeze.com, Brandt said. The only functional part of the program is a setting that can turn off the phone's wi-fi radio and other RF-heavy, power-consuming components, he added. On the other hand, Brandt said a part of the adware, BaseStarReceiver, sends a message to let sigma.sqadtracker.com know that the program is displaying the full-screen banner ad. It then loads a service called NotifAdSDK, which checks in (and sends along the user's profile information) every four hours. "Looks like some basic information about the device itself: its screen size; the version of the browser and OS on the device; the program which is generating the traffic (com.androidupgrade.battery) and its version; the name of the campaign (eversave1); the device’s manufacturer and model; the network the device uses; the phone’s coarse (mobile network) or fine (GPS) location; the IMEI and phone number; the app’s API key, and a unique identifier for the device," Brandt said. Data mining A user who triggers the “free upgrade" process will have the program shift its data mining into high gear, Solera said. "Bottom line, the app isn’t malicious, but does have seriously intrusive elements that might be considered undesirable by some users and/or their employers—and if the adware guys can do it, so can the malware makers," Brandt said. He said the installation process "clearly draws on effective social engineering techniques that have been well refined in the world of Windows malware." "We still don’t know who’s behind the adware. The domain WHOIS data for all three domains has been hidden behind a private registration. For now, the 'your battery is running out of juice' ad campaigns have run out of juice. I think it’s fair to assume, at this point, none of them are up to any good, and you shouldn’t trust the lot of them," he said. Meanwhile, an article on PC World noted battery ads are used as a ploy as they tap into a common anxiety, that their phones may be sucked dry. "What do the makers of Battery Doctor/Battery Upgrade have to say about their apps? We couldn't find them. No contact information for the publishers appears within the app itself. The domain that hosts the ad and download was registered through a service that shields the owners' contact information," it added. PC World also noted some unsuspecting Android users heeded battery-conservation ads and downloaded an Android Trojan horse program called Battery Saver (GGTracker) earlier this year. Sleazy ads? PC World said it chanced on the Battery Doctor ad on an ad-sponsored version of Scrabble EA Mobile, though the ad was pulled after PC World notified the concerned parties. But PC World said it also found other top free Android games delivering similar ads. Android a target PC World quoted security firm McAfee as saying malware targets the Android OS disproportionately because it is the largest mobile platform in the world. A 2011 report by McAfee said malware targeting Android phones jumped 76 percent from the previous quarter. "Fortunately, the numbers of people who have been directly affected by mobile malware are still small: about 2 percent of U.S. Android users and 5 percent worldwide, according to Lookout's numbers," it said. Safety tips PC World offered five precautions to keep mobile malware off an Android phone:

• Be suspicious of messages that pop up on your phone and claim you need to update the device's software. When in doubt, call your wireless carrier and ask if you really need a patch or update.
• Download mobile security protection.
• Pay close attention to the permissions that apps request. Google's Android Market breaks down exactly what each app wants to access on your phone.
• Read app reviews carefully, and consider the app's star rating and how many people have downloaded it. Be suspicious of third-party app stores that offer paid apps for free.
• Watch for signs that your phone may be infected.